Disposable & undeliverable detection

Every check runs the steps below. Most addresses are answered without any network lookup.

1. Format validation

The address is validated before anything else. Invalid input returns 400.

• Input is trimmed and lowercased. A trailing root dot is dropped ([email protected].).
• Local part (before @): 1 to 64 characters from a-z 0-9 ! # $ % & ' * + / = ? ^ _ ` { | } ~ . -.
• Domain: at most 253 characters, at least two labels, each label 1 to 63 characters of a-z 0-9 - that does not start or end with -.
• Rejected: non-ASCII addresses (josé@exemple.fr, user@bücher.de), quoted local parts ("john doe"@x.com), spaces, a missing @ or domain, and addresses with nothing left after normalization ([email protected]).

400 means the text is not an email address at all. deliverable: false means it is a well-formed address that can't receive mail.

2. Impossible mailboxes

Each big provider has rules for which usernames can exist. An address that breaks them can never receive mail, so it returns deliverable: false with no DNS lookup. disposable stays false: the address is made up or mistyped, not a throwaway.

Provider	Rule
Gmail	Letters, numbers and periods only. 4 to 30 letters and digits (periods not counted, see below).
Fastmail	No hyphens.
Outlook	Starts with a letter.
Yahoo	At least one letter. 4 to 32 characters.
Proton	At most 40 characters. Starts with a letter or digit.
iCloud	No rule (Apple documents only a minimum length, and old accounts may predate it).

Input	deliverable	Why
[email protected]	false	Gmail never allows _
[email protected]	false	Gmail: fewer than 4 letters and digits
[email protected]	false	Fastmail never allows -
[email protected]	false	Outlook: must start with a letter
[email protected]	false	Yahoo: shorter than 4 characters
[email protected]	false	Yahoo: no letter

Each rule is applied only in the form that holds for every address that can receive mail, and to the inbox rather than the spelling, so every alias of one inbox gets the same answer:

• Gmail length. Gmail asks for 6 to 30 characters at signup but ignores periods when delivering, so the length is checked on the inbox without periods: fewer than 4 letters and digits, or more than 30, can't exist. [email protected] and [email protected] are both deliverable.
• Gmail period placement (leading, trailing or double periods) is only a rule for creating accounts. [email protected] still reaches johnsmith, so it is accepted.
• Proton ignores ., _ and - when delivering, so its rules are checked without them. [email protected] is accepted.
• Yahoo disposable addresses ([email protected]) use a separate base name, so an address containing - is never checked.
• Google Workspace and other custom domains choose their own usernames, so they are never checked.

3. Domain checks

For any address that passes the username rules, the first step that matches decides the result:

Step	Check	Example	disposable	deliverable
1	Known mailbox provider (Gmail, Outlook, Yahoo, iCloud, Proton, Fastmail). No lookup	[email protected]	false	true
2	Privacy relay (Firefox Relay, DuckDuckGo, SimpleLogin, addy.io, Apple), or a domain whose mail goes through one	[email protected]	false	true
3	Known disposable domain (built-in list plus learned domains, parent domains match too). No lookup	[email protected]	true	true
4	Disposable keyword in the domain (tempmail, mailinator, yopmail, …). No lookup	[email protected]	true	true
5	DNS: the domain does not exist	[email protected]	false	false
5	DNS: the domain publishes a null MX ("accepts no mail")	[email protected]	false	false
5	DNS: no mail server resolves		false	false
6	The mail server belongs to a known disposable service	a new domain using a throwaway service's mail server	true	true
7	Signal score of 5 or more (below)	a new domain with no website, placeholder SPF, no reverse DNS	true	true
8	None of the above	[email protected]	false	true

Disposable domains are deliverable: true because they do receive mail. That is exactly what makes them useful for abuse.

Privacy relays are disposable: false because they forward to a real, long-lived inbox. They hide the owner's address, but they are not throwaway domains.

Signals

For an unknown domain, its DNS records are scored:

Signal	Points	Meaning
Known disposable server	3	A mail server host or IP was learned from an earlier disposable domain
No website	2	Neither the domain nor www resolves, so it only receives mail
Placeholder SPF	2	SPF authorizes no real sender (-all only, or only reserved or public-resolver IPs)
No reverse DNS	2	No PTR record on any mail-server IP. Real mail hosts always have one
No SPF	1	No SPF record
No DMARC	1	No DMARC record

5 or more points gives disposable: true. A learned server alone (3 points) is not enough, so one wrongly learned IP can't block a legitimate domain.

Learning

Only disposable domains are learned. When a new throwaway domain is detected (by keyword, mail server or signals), Signitize remembers the domain and, when DNS was checked, its mail-server hosts and IPs:

1. [email protected] is detected by its signals. The domain and its mail server are remembered.
2. The next @new-burner.xyz address is caught immediately, without a lookup.
3. A sibling domain using the same mail server starts with 3 points, so it only needs 2 more to be caught.

Nothing else is learned. Undeliverable domains are re-checked every time because DNS can change. Mail servers of shared providers (Google, Microsoft, Zoho, …) are never learned, so one bad domain hosted there can't affect anyone else. The addresses you check are never stored.

Speed and failure handling

• No lookup for invalid addresses, impossible mailboxes, known providers, relays, known disposable domains and keywords.
• Cache: DNS results are cached per domain for up to an hour, and concurrent checks for one domain share a single lookup. Failed lookups are not cached.
• Timeouts: each DNS query times out after 3 seconds.
• Fail open: if a DNS lookup fails, the check still answers 200. Impossible mailboxes, listed disposable domains and keywords are still caught. An address that needed DNS gives disposable: false and deliverable: true, because a failed lookup proves nothing.
• Signitize unavailable: if a check can't be completed at all, you get 503, never a guessed 200. It is not counted. Handle it as in Never block a signup.

Limitations

• Routing controlled by a domain's admin (catch-alls, aliases on custom domains) can't be detected from the address alone.
• iCloud Hide My Email addresses on @icloud.com look exactly like normal ones. Only privaterelay.appleid.com is recognized as a relay.
• Fastmail custom domains are treated as unknown domains.
• Signals catch throwaway domains that are set up cheaply. A temp-mail service with a real website, SPF and reverse DNS scores as legitimate until it is listed, or until one of its rotating domains trips the signals and the shared server is learned.
• deliverable: true means the domain accepts mail. It does not prove that the mailbox exists. Confirm with a verification email.
• iCloud has no username rule, so impossible iCloud usernames are not detected. The Outlook, Yahoo and Proton rules come from their signup pages and apply to new accounts, so a very old account that breaks them could be reported as undeliverable. If that happens to one of your users, tell us.